WordPress Integrio Core plugin < 1.2.8 - Local File Inclusion vulnerability

Vulnerability

A local file inclusion vulnerability exists in the Integrio Core WordPress plugin for versions prior to 1.2.8 [1]. The flaw is reachable without any authentication and allows arbitrary file reads within the server's filesystem. Versions below 1.2.8 are affected; the fix is introduced in version 1.2.8 [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable endpoint with no prior authentication or user interaction required [1]. The attack does not require any special network position as it can be performed remotely. The path traversal payload is included in a parameter that is not properly sanitized [1].

Impact

Successful exploitation allows an unauthenticated attacker to include and display the contents of local files from the target web server [1]. This can expose sensitive information such as database credentials, configuration files, or other secrets, potentially leading to full site compromise and database takeover depending on the configuration [1].

Mitigation

The vulnerability is fixed in version 1.2.8 of the Integrio Core plugin [1]. All users should update to this version immediately. Patchstack also provides a mitigation rule to block exploitation attempts until the update is applied [1]. No other workarounds are mentioned in the available references.